Skip to content

ci: adopt the consolidated .NET workflow, and stop a blocking gate failing pull requests #396

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
matt-edmondson merged 1 commit into from
Sep 13, 2026
Merged

ci: adopt the consolidated .NET workflow, and stop a blocking gate failing pull requests #396

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
230 changes: 140 additions & 90 deletions .github/workflows/dotnet.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,12 +89,18 @@ jobs:
exit 1
fi

# macOS is back in this mapping. It was excluded because a macOS runner widened
# ImGui.App's target frameworks to include net10.0-ios, which needs a workload this job
# does not install, so every macOS cell failed during its build with NETSDK1147. That
# widening is now opt-in (IncludeIosTargets, set only by the iOS workflow), so a macOS
# cell builds exactly what Linux and Windows build. An ios-tied test project would still
# have nowhere to run and fails the guard above rather than silently disappearing.
# macOS is back in this mapping. It was excluded org-wide because of one repository:
# a macOS runner widened ktsu-dev/ImGuiApp's target frameworks to include net10.0-ios,
# which needs a workload this job does not install, so every macOS cell failed during
# its build with NETSDK1147 -- and every other repository paid for that by losing a
# platform it had no trouble on. That widening is now opt-in (IncludeIosTargets, set
# only by the iOS workflow), so a macOS cell builds exactly what Linux and Windows
# build. An ios-tied test project would still have nowhere to run and fails the guard
# above rather than silently disappearing.
#
# The UI test projects, which are what makes a test job expensive, are run on Linux
# only -- see the Test step below -- so a macOS cell stays cheap despite macOS minutes
# being billed at roughly ten times Linux.
matrix=$(echo "$projects" | jq -c '
{
include: [
Expand Down Expand Up @@ -156,7 +162,14 @@ jobs:
- name: Setup .NET SDK ${{ env.DOTNET_VERSION }}
uses: actions/setup-dotnet@v6
with:
dotnet-version: ${{ env.DOTNET_VERSION }}.x
# Test projects commonly multi-target every framework their library publishes, so the
# test hosts for the older ones need those runtimes present alongside the SDK, or the
# run fails looking for a framework it was built against. global.json pins the SDK, so
# naming the older versions here only adds runtimes -- it does not change what builds.
dotnet-version: |
8.0.x
9.0.x
${{ env.DOTNET_VERSION }}.x
cache: true
cache-dependency-path: |
**/*.csproj
Expand All @@ -182,20 +195,21 @@ jobs:
# A project the host cannot build is skipped and named before anything is built, and a
# project that fails does not stop the ones after it, so one run reports everything broken.
#
# The five UI suites are effectively the whole cost of this job. They run in parallel, so the
# slowest of them sets the job's duration, while all nine other test projects finish in about
# thirty-four seconds combined. They are therefore run on Linux only -- which is also what
# keeps macOS affordable now that it is back in the matrix, since macOS runner minutes are
# billed at roughly ten times Linux:
# UI test projects are run on Linux only. What they exercise is a pure managed CPU
# rasterizer with no window, GPU or driver, so one platform covers the same ground, and
# Linux is both the faster host for that work and much the cheaper runner -- which is also
# what keeps macOS affordable now that it is in the matrix, since macOS runner minutes are
# billed at roughly ten times Linux.
#
# * measured per assembly on Windows: 17m28s, 14m32s, 10m05s, 8m20s, 1m01s against ~34s for
# everything else, in a job whose test phase took 17m45s.
# * what they exercise is a pure managed CPU rasterizer with no window, GPU or driver. Timed
# on one machine, self-contained for each runtime, it renders the same workload in 482.6ms
# on Windows against 476.0ms on Linux, so running it on one platform covers the same ground.
# * Linux is the faster host for this work, so it keeps them.
# Where these suites exist they dominate the job. Measured in ktsu-dev/ImGuiApp, five of
# them took 17m28s, 14m32s, 10m05s, 8m20s and 1m01s on Windows against about thirty-four
# seconds for all nine other test projects combined, in a test phase of 17m45s; the
# rasterizer itself renders the same workload in 482.6ms on Windows against 476.0ms on
# Linux, self-contained for each runtime and timed on one machine. A repository with no UI
# test project matches nothing here and is unaffected, which is why the rule is safe to
# carry in the shared workflow.
#
# Only the UI test projects are excluded. The example applications they drive stay in the
# Only the test projects are excluded. The example applications they drive stay in the
# build on every platform, so a change that breaks one still fails here.
#
# The test is on Linux rather than against Windows, so a platform added to the matrix later
Expand Down Expand Up @@ -260,7 +274,14 @@ jobs:
- name: Setup .NET SDK ${{ env.DOTNET_VERSION }}
uses: actions/setup-dotnet@v6
with:
dotnet-version: ${{ env.DOTNET_VERSION }}.x
# Test projects commonly multi-target every framework their library publishes, so the
# test hosts for the older ones need those runtimes present alongside the SDK, or the
# run fails looking for a framework it was built against. global.json pins the SDK, so
# naming the older versions here only adds runtimes -- it does not change what builds.
dotnet-version: |
8.0.x
9.0.x
${{ env.DOTNET_VERSION }}.x
cache: true
cache-dependency-path: |
**/*.csproj
Expand All @@ -272,8 +293,68 @@ jobs:
run: New-Item -Path "$env:USERPROFILE\.nuget\packages" -ItemType Directory -Force
shell: pwsh

- name: Cache SonarQube Cloud packages
# SonarCloud is a third party, and when it is down the scanner fails in pre-processing —
# before a single project is compiled or a single test runs. A total outage therefore turned
# every pull request red while saying nothing about the change, which is a false signal
# rather than a quality gate. Probed here so that an outage skips analysis instead.
#
# Three attempts, because the point is to tell an outage from a blip: analysis is worth
# having, and one slow response should not cost a run its quality gate.
#
# Where the gate is blocking, an outage still fails. Skipping is safe only while the gate is
# advisory: the Release step below is implicitly gated on the steps before it succeeding, and
# a skipped step is not a failed one, so forgiving an outage in a repository that has opted
# in would release past the very gate it opted into.
#
# Skipping is otherwise deliberately loud. No quality gate is produced when analysis is
# skipped, so the SonarCloud check simply does not report — it is never made to look as though
# it passed, and a branch rule that requires it still holds the merge until a human decides.
- name: Probe SonarQube Cloud
id: sonar
if: ${{ env.SONAR_TOKEN != '' }}
env:
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
SONAR_BLOCKING_GATE: ${{ vars.SONAR_BLOCKING_GATE }}
shell: pwsh
run: |
$available = $false
foreach ($attempt in 1..3) {
try {
$response = Invoke-WebRequest -Uri "https://sonarcloud.io/api/server/version" -Method Get -TimeoutSec 20
if ($response.StatusCode -eq 200) {
Write-Host "sonarcloud.io answered on attempt $attempt."
$available = $true
break
}

Write-Host "Attempt ${attempt}: sonarcloud.io answered $($response.StatusCode)."
} catch {
Write-Host "Attempt ${attempt}: sonarcloud.io did not answer. $($_.Exception.Message)"
}

if ($attempt -lt 3) { Start-Sleep -Seconds (10 * $attempt) }
}

"available=$($available.ToString().ToLowerInvariant())" >> $env:GITHUB_OUTPUT

if ($available) { exit 0 }

# Only a run that could publish is held to a blocking gate. A pull request cannot
# release, so failing it would cost exactly the tolerance this step exists for and buy
# nothing: a required SonarCloud check still holds the merge, because a skipped analysis
# reports no gate at all.
if ($env:SONAR_BLOCKING_GATE -eq 'true' -and $env:GITHUB_EVENT_NAME -ne 'pull_request') {
Write-Host "::error title=SonarQube Cloud unreachable::The quality gate is blocking for this repository and this run could publish, so it fails rather than releasing ungated."
exit 1
}

Write-Host "::warning title=SonarQube Cloud unreachable::Static analysis was skipped. The build and tests still ran and still had to pass, but no quality gate was produced, so this run is not evidence that one would pass."
"### SonarQube Cloud unreachable" >> $env:GITHUB_STEP_SUMMARY
"" >> $env:GITHUB_STEP_SUMMARY
"Static analysis was skipped for this run. The build and tests still ran; no quality gate was produced." >> $env:GITHUB_STEP_SUMMARY

- name: Cache SonarQube Cloud packages
if: ${{ env.SONAR_TOKEN != '' && steps.sonar.outputs.available == 'true' }}
uses: actions/cache@v6
env:
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
Expand All @@ -283,7 +364,7 @@ jobs:
restore-keys: ${{ runner.os }}-sonar

- name: Cache SonarQube Cloud scanner
if: ${{ env.SONAR_TOKEN != '' }}
if: ${{ env.SONAR_TOKEN != '' && steps.sonar.outputs.available == 'true' }}
id: cache-sonar-scanner
uses: actions/cache@v6
env:
Expand All @@ -294,7 +375,7 @@ jobs:
restore-keys: ${{ runner.os }}-sonar-scanner

- name: Install SonarQube Cloud scanner
if: ${{ env.SONAR_TOKEN != '' && steps.cache-sonar-scanner.outputs.cache-hit != 'true' }}
if: ${{ env.SONAR_TOKEN != '' && steps.sonar.outputs.available == 'true' && steps.cache-sonar-scanner.outputs.cache-hit != 'true' }}
env:
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
shell: pwsh
Expand Down Expand Up @@ -378,62 +459,6 @@ jobs:
}
"version=$($matches[0].Trim())" >> $env:GITHUB_OUTPUT

# SonarCloud is a third party, and when it is down the scanner fails in pre-processing —
# before a single project is compiled or a single test runs. A total outage therefore turned
# every pull request red while saying nothing about the change, which is a false signal
# rather than a quality gate. Probed here so that an outage skips analysis instead.
#
# Three attempts, because the point is to tell an outage from a blip: analysis is worth
# having, and one slow response should not cost a run its quality gate.
#
# Where the gate is blocking, an outage still fails. Skipping is safe only while the gate is
# advisory: the Release step below is implicitly gated on the steps before it succeeding, and
# a skipped step is not a failed one, so forgiving an outage in a repository that has opted
# in would release past the very gate it opted into.
#
# Skipping is otherwise deliberately loud. No quality gate is produced when analysis is
# skipped, so the SonarCloud check simply does not report — it is never made to look as though
# it passed, and a branch rule that requires it still holds the merge until a human decides.
- name: Probe SonarQube Cloud
id: sonar
if: ${{ env.SONAR_TOKEN != '' }}
env:
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
SONAR_BLOCKING_GATE: ${{ vars.SONAR_BLOCKING_GATE }}
shell: pwsh
run: |
$available = $false
foreach ($attempt in 1..3) {
try {
$response = Invoke-WebRequest -Uri "https://sonarcloud.io/api/server/version" -Method Get -TimeoutSec 20
if ($response.StatusCode -eq 200) {
Write-Host "sonarcloud.io answered on attempt $attempt."
$available = $true
break
}

Write-Host "Attempt ${attempt}: sonarcloud.io answered $($response.StatusCode)."
} catch {
Write-Host "Attempt ${attempt}: sonarcloud.io did not answer. $($_.Exception.Message)"
}

if ($attempt -lt 3) { Start-Sleep -Seconds (10 * $attempt) }
}

"available=$($available.ToString().ToLowerInvariant())" >> $env:GITHUB_OUTPUT

if ($available) { exit 0 }

if ($env:SONAR_BLOCKING_GATE -eq 'true') {
Write-Host "::error title=SonarQube Cloud unreachable::The quality gate is blocking for this repository, so a run that cannot produce one fails rather than releasing past it."
exit 1
}

Write-Host "::warning title=SonarQube Cloud unreachable::Static analysis was skipped. The build and tests still ran and still had to pass, but no quality gate was produced, so this run is not evidence that one would pass."
"### SonarQube Cloud unreachable" >> $env:GITHUB_STEP_SUMMARY
"" >> $env:GITHUB_STEP_SUMMARY
"Static analysis was skipped for this run. The build and tests still ran; no quality gate was produced." >> $env:GITHUB_STEP_SUMMARY

# The quality gate blocks the release only where a repository opts in, by setting the
# SONAR_BLOCKING_GATE repository variable to true. It is not on by default because most of
# these repositories carry security hotspots that have never been reviewed, and a gate they
Expand All @@ -445,8 +470,19 @@ jobs:
env:
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
SONAR_BLOCKING_GATE: ${{ vars.SONAR_BLOCKING_GATE }}
SONAR_COVERAGE_EXCLUSIONS_EXTRA: ${{ vars.SONAR_COVERAGE_EXCLUSIONS_EXTRA }}
shell: pwsh
run: |
# A file that cannot be executed rather than one nobody has got round to testing --
# a windowed entry point, say -- is excluded per repository through the
# SONAR_COVERAGE_EXCLUSIONS_EXTRA variable, so this workflow stays identical
# everywhere instead of accumulating one repository's paths for all the others to carry.
$coverageExclusions = '**/*Test*.cs,**/*.Tests.cs,**/*.Tests/**/*,**/obj/**/*,**/*.dll,**/NativeExports.cs'
if (-not [string]::IsNullOrWhiteSpace($env:SONAR_COVERAGE_EXCLUSIONS_EXTRA)) {
$coverageExclusions += ',' + $env:SONAR_COVERAGE_EXCLUSIONS_EXTRA.Trim()
Write-Host "Excluding additionally from coverage: $($env:SONAR_COVERAGE_EXCLUSIONS_EXTRA.Trim())"
}

$sonarArgs = @(
'begin'
'/k:${{ github.repository_owner }}_${{ github.event.repository.name }}'
Expand All @@ -456,7 +492,7 @@ jobs:
'/d:sonar.host.url=https://sonarcloud.io'
'/d:sonar.projectBaseDir=${{ github.workspace }}'
'/d:sonar.cs.vscoveragexml.reportsPaths=coverage/**/coverage.xml'
'/d:sonar.coverage.exclusions=**/*Test*.cs,**/*.Tests.cs,**/*.Tests/**/*,**/obj/**/*,**/*.dll,**/NativeExports.cs'
"/d:sonar.coverage.exclusions=$coverageExclusions"
'/d:sonar.cs.vstest.reportsPaths=coverage/**/*.trx'
'/d:sonar.exclusions=**/NativeExports.cs'
)
Expand Down Expand Up @@ -495,21 +531,29 @@ jobs:
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

- name: End SonarQube
id: sonar_end
if: env.SONAR_TOKEN != '' && steps.sonar.outputs.available == 'true' && steps.pipeline.outputs.build_skipped != 'true'
env:
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
SONAR_BLOCKING_GATE: ${{ vars.SONAR_BLOCKING_GATE }}
shell: pwsh
run: |
.\.sonar\scanner\dotnet-sonarscanner end /d:sonar.token="$env:SONAR_TOKEN"
if ($LASTEXITCODE -eq 0) { exit 0 }
if ($LASTEXITCODE -eq 0) {
"analysed=true" >> $env:GITHUB_OUTPUT
exit 0
}

# Whatever happens below, no gate came out of this run. The Release step reads this.
"analysed=false" >> $env:GITHUB_OUTPUT

# The upload failed. An outage that began after the probe looks exactly like this, and
# forgiving it is the same judgement the probe makes — but only when the server really is
# unreachable, so a malformed report, a bad token or a rejected analysis still fails here.
# Where the gate is blocking it is never forgiven: with `sonar.qualitygate.wait=true` a
# failed gate is one of the ways this command exits non-zero.
if ($env:SONAR_BLOCKING_GATE -eq 'true') { exit 1 }
# Where the gate is blocking it is not forgiven on a run that could publish: with
# `sonar.qualitygate.wait=true` a failed gate is one of the ways this command exits
# non-zero. A pull request publishes nothing, so it is forgiven like any other.
if ($env:SONAR_BLOCKING_GATE -eq 'true' -and $env:GITHUB_EVENT_NAME -ne 'pull_request') { exit 1 }

try {
$response = Invoke-WebRequest -Uri "https://sonarcloud.io/api/server/version" -Method Get -TimeoutSec 20
Expand All @@ -522,13 +566,19 @@ jobs:
"The analysis upload failed and sonarcloud.io is unreachable. No quality gate was produced; the build and tests still ran." >> $env:GITHUB_STEP_SUMMARY
}

# Gated by the step above, but only where the gate is blocking. With SONAR_BLOCKING_GATE
# set, `sonar.qualitygate.wait=true` makes a failed gate fail that step, and a step whose
# `if:` names no status function is implicitly gated on success, so a release cannot proceed
# past a gate the project did not pass. Without it the analysis is still published and the
# gate still evaluated, it just does not hold up the release.
# Gated on the quality gate where the repository opted into a blocking one. With
# SONAR_BLOCKING_GATE set, `sonar.qualitygate.wait=true` makes a failed gate fail the step
# above, and a step whose `if:` names no status function is implicitly gated on success, so
# a gate the project did not pass already stops the release.
#
# What that implicit gating does not cover is a gate that never happened: an outage skips
# the analysis, and a skipped step is not a failed one. So the two Sonar outputs are named
# here explicitly. `available` is empty when there is no SONAR_TOKEN, which holds a release
# in a repository that asked for a blocking gate it has no way to produce -- the safe side
# of a contradictory configuration. Without the variable, none of this applies: the analysis
# is still published and the gate still evaluated, it just does not hold up the release.
- name: Release
if: steps.pipeline.outputs.should_release == 'true'
if: steps.pipeline.outputs.should_release == 'true' && (vars.SONAR_BLOCKING_GATE != 'true' || (steps.sonar.outputs.available == 'true' && steps.sonar_end.outputs.analysed != 'false'))
shell: pwsh
env:
GH_TOKEN: ${{ github.token }}
Expand Down